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About PTAC 


The U.S. Department of Education established the Privacy Technical Assistance Center (PTAC) as a 
“one-stop” resource for education stakeholders to learn about data privacy, confidentiality, and security 
practices related to student-level longitudinal data systems and other uses of student data. PTAC 
provides timely information and updated guidance through a variety of resources, including training 
materials and opportunities to receive direct assistance with privacy, security, and confidentiality of 
student data systems. More PTAC information is available at https://studentprivacy.ed.gov. PTAC 
welcomes input on this document and suggestions for future technical assistance resources relating to 
student privacy. Comments and suggestions can be sent to PrivacyTA@ed.gov. 


Purpose and Scope 


The Privacy Technical Assistance Center (PTAC) has received an increasing number of questions from 
postsecondary educational institutions (institutions) on the conditions under which federal student 
financial aid information may be used for program evaluation and research purposes. Numerous federal 
laws govern access to, disclosure of, and use of student financial aid information, including, but not 
limited to: Section 444 of the General Education Provisions Act (commonly referred to as the Family 
Educational Rights and Privacy Act [FERPA]); the Higher Education Act of 1965, as amended (HEA); and 
the Privacy Act of 1974, as amended (Privacy Act). As the interplay of these various laws in different 
situations can be complex, in addition to the following discussion, this document provides some 
questions and answers about possible situations in which student financial aid information may, or may 
not, be used for these purposes. 


The scope of this document is limited to legal requirements and restrictions under federal statutes and 
regulations. Additional state or local laws may also apply, and institutions are encouraged to consult with 
their legal counsel before undertaking any data sharing or data use activities involving student data or 
student financial aid information. 


It is important to note that this document discusses data sharing and disclosures of student financial aid 
information that are permissible under federal law. Institutions have a responsibility to safeguard the 
sensitive personal information entrusted to them, and compliance with the law is only the beginning of 
that process. Before considering any of the disclosures discussed in this document, institutions should 
evaluate the impact that the disclosure may have on students’ privacy. Similarly, when sharing data with 
authorized third parties, institutions should only disclose the minimum amount of information necessary 
to accomplish the intended objectives. For more information, see PTAC’s resources on data 
minimization best practices, available at https://studentprivacy.ed.gov/resources. 
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Types of Financial Aid Data 


Institutions have different types of student financial aid information, some of which are provided to the 
institution by the U.S. Department of Education (the Department), some of which are directly obtained 
from students, and some of which are created by the institution. Different federal laws may impact 
institutions’ use of this information, depending on the source of the data and whether personally 
identifiable information (PII) has been properly de-identified. 


PIl is information that can be used to identify an individual. FERPA’s definition of Pll includes any 
information that, alone or in combination, is linked or linkable to a specific student that would allow a 
reasonable person in the school community to identify the student with reasonable certainty.! If Pll has 
been successfully removed from data, then these de-identified data may be disclosed without the 
individual’s consent.? It is important to note that proper de-identification of education records 
consistent with FERPA’s definition of PIl is often difficult and generally entails more than removing the 
student’s name and identifying number (e.g., Social Security number). Proper de-identification of 
individual-level student data typically requires the removal of all direct and indirect identifiers, followed 
by the application of one or more statistical disclosure limitation (SDL) techniques. These techniques 
include suppression (e.g., redacting all or some of the records for students from small subgroups or with 
uncommon characteristics), recoding (e.g., replacing continuous variables like income with categorical 
variables like income quartile), and perturbation (e.g., introducing noise or error into the data or 
swapping variable values for individuals at risk of re-identification). More information about the 
application of these types of SDL techniques on education data is available through PTAC at 
https://studentprivacy.ed.gov. 


To understand how institutions may use student financial aid information for program evaluation and 
research purposes, it is important to first distinguish the different types and sources of data, and the 
federal laws that govern them. 


National Student Loan Data System (NSLDS) 


NSLDS is the Department's central database for information about individual student aid recipients and 
provides a centralized, integrated view of a student’s Title IV loans and grants through their entire 
lifecycle, from aid disbursement through closure. NSLDS data include data received from institutions, 
agencies that guarantee loans and loan holders in the Federal Family Education Loan (FFEL) Program, 
and the Department’s student loan servicers. 


Free Application for Federal Student Aid (FAFSA) and Institutional Student Information 
Record (ISIR) 


Current and prospective college students (and in some cases their parents) fill out the FAFSA to apply 
for assistance under the federal student financial aid programs. The FAFSA may also be used to apply for 
state and institutional student aid. Applicants submit the completed FAFSA to the Department, which 
then processes the FAFSA information to determine the student’s financial aid eligibility. The electronic 
record generated by the Department from the FAFSA and provided to institutions and state student aid 


' 34 CFR § 99.3 
> 34 CFR § 99.31 (b) 
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agencies is the ISIR. The FAFSA applicant receives similar information from the Department ona 
Student Aid Report (SAR). 


The ISIR contains information reported on the FAFSA, key processing results, and the student’s financial 
aid history as reflected in the NSLDS. Since it is the use of the information provided to institutions on 
the ISIR that results in the institution’s determination of the student’s aid eligibility, that eligibility and the 
resultant award and disbursement data, including information from the Common Origination and 


Disbursement (COD) System, are covered by the same usage and disclosure requirements that apply to 
FAFSAVISIR information. 


Education Records 


Under FERPA, an education record is, except as otherwise provided, any record that directly relates to 
the student and that is maintained by, or on behalf of, an educational agency or institution or a party 
acting for the educational agency or institution.3 This definition includes student financial aid information, 
including information from ISIRs, information directly obtained from NSLDS and COD, and information 
from the institution’s own financial aid systems and databases, so long as the student financial aid 
information is directly related to a student and is maintained by the institution or a party acting on 
behalf of it. 


Applicable Laws 


The applicable federal laws related to the matters discussed in this guidance include FERPA, the HEA, 
and the Privacy Act. As the access and use restrictions of these statutes are jointly implicated in any 
proposed disclosure and use of financial aid information by an educational institution, the most 
restrictive provisions of each law will apply. 


Family Educational Rights and Privacy Act (FERPA) 


FERPA is a federal law that protects the privacy of student education records. FERPA applies to all 
educational agencies and institutions that receive funds under a program administered by the 
Department. This includes institutions that participate in the federal student assistance programs 
authorized under Title IV of the HEA. 


In the postsecondary context, FERPA gives students? the right to 
* inspect and review their education records, except as otherwise limited;> 


* request that information that is inaccurate, misleading, or in violation of the students’ rights of 
privacy be amended (corrected); and 


* consent to disclosure of their education records and the PIl contained therein, unless an 
exception to FERPA’s general consent requirement applies. 


> 20 U.S.C. 1232g(a)(4) and 34 CFR § 99.3 

* FERPA establishes rights for parents. When a student turns 18, or enrolls at a postsecondary institution at any 
age, those rights transfer to the student. 20 U.S.C. 1232g(d) 

° 34 CFR § 99.12 
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Any ISIR information or any other student financial aid data that are directly related to a student and 
provided to and maintained by an institution, or created and maintained by an institution, constitute 
education records under FERPA, and are protected against unauthorized release. Therefore, when 
disclosing student financial aid data to other entities, such as researchers, institutions must consider 
whether prior written consent from the student is required. Institutions must also comply with FERPA’s 
other data protection provisions, such as its record-keeping requirements. 


FERPA has several exceptions to the general requirement of consent that permit educational institutions 


to disclose Pll from education records without consent, provided all applicable FERPA requirements are 
met. Some of those exceptions include: 


Financial Aid Exception 


Under FERPA’s Financial Aid Exception, institutions may disclose, without prior written consent, PIl 
from education records in connection with financial aid for which a student has applied or which a 
student has received, if the information is necessary to 

¢ determine the student’s eligibility for the aid; 

e determine the amount of the aid; 


e determine the conditions for the aid; or 


¢ enforce the terms and conditions of the aid.¢ 


School Official Exception 


Under FERPA’s School Official Exception, institutions may disclose, without prior written consent, Pll 
from education records to other individuals within the institution, or to others outside the institution 
serving as school officials (e.g., to a contractor, consultant, volunteer, or other party) provided that the 
recipient of the records 


* performs an institutional service or function for which the institution would otherwise use 
employees (if disclosing to a party outside the institution); 


¢ is under the direct control of the institution with respect to the use and maintenance of 
education records; 


* only uses the PIl from education records for the purpose(s) for which the disclosure was made 
and only further discloses Pll from education records as authorized by the institution and in 
compliance with FERPA; 

* meets the criteria specified in the institution’s annual notification of FERPA rights; and 

¢ has been determined by the institution to have a legitimate educational interest in the education 


records.” 


6 20 U.S.C. 1232g(b)(1)(D) and 34 CFR § 99.31 (a)(4) 
720 U.S.C. 1232g(b)(1)(A) and 34 CFR § 99.31 (a)(I). 
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It is the responsibility of each institution to establish criteria defining who is considered a “school 
official” and what constitutes a “legitimate educational interest.” These criteria may differ from one 
institution to the next. The criteria for both must be published in the institution’s annual notification of 
FERPA rights. 


Audit and Evaluation Exception 


FERPA’s Audit and Evaluation Exception allows an institution to disclose, without prior written consent 
from the student, Pll from student education records to authorized representatives of certain officials 
and entities including, but not limited, to state and local educational authorities. While individual 
institutions are typically not considered educational authorities under state law, it is common for states 
to establish a postsecondary educational authority (e.g., a Higher Education Governing Board, a Board of 
Regents, or a similar entity) to evaluate postsecondary education programs within the state. These 
entities are considered educational authorities under FERPA. Access to such PII may only be given to 
authorized representatives of educational authorities in connection with an audit or evaluation of 
federal- or state-supported education programs, or for the enforcement of, or compliance with, federal 
legal requirements that relate to those programs. Unless the authorized representative is an employee 
of the state or local educational authority, there must be a written agreement in which the authorized 
representative has been so designated.8 


Studies Exception 


FERPA’s Studies Exception allows institutions to disclose, without prior written consent from the 
student, PII from student education records to a third party (e.g., an outside researcher, nonprofit 
organization, etc.) conducting a study for, or on behalf of, the institution for the purpose of 

¢ developing, validating, or administering predictive tests; 

¢ administering student aid programs; or 

¢ improving instruction.? 
Under the Studies Exception, an institution may disclose Pll from education records and a state or local 
educational authority or agency headed by an official listed in 34 CFR § 99.31 (a)(3) may redisclose 
personally identifiable information from education records, only if 

¢ the study is conducted in a manner that does not permit personal identification of parents and 

students by individuals other than representatives of the organization that have legitimate 


interests in the information; 


¢ the information is destroyed when no longer needed for the purposes for which the study was 
conducted; and 


¢ the [institution or state or local educational authority or agency headed by an official listed in 34 
CFR § 99.31 (a)(3)] enters into a written agreement with the organization that 


8 20 U.S.C. 1232g(b)(1)(C), (b)(3), and (b)(5) and 34 CFR §§ 99.31 (a)(3) and 99.35. 
? 20 U.S.C. 1232g(b)(1)(F) and 34 CFR § 99.31 (a)(6). 
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© specifies the purpose, scope, and duration of the study or studies and the information to 
be disclosed; 


© requires the organization to use personally identifiable information from education 
records only to meet the purpose or purposes of the study as stated in the written 
agreement; 


© requires the organization to conduct the study in a manner that does not permit 
personal identification of parents and students, as defined in this part, by anyone other 
than representatives of the organization with legitimate interests; and 


© requires the organization to destroy all personally identifiable information when the 
information is no longer needed for the purposes for which the study was conducted 
and specifies the time period in which the information must be destroyed.!° 


Higher Education Act 


The HEA is the federal law that governs the administration of most federal student financial aid 
programs. The HEA authorizes numerous federal student aid programs that provide support to both 
individuals pursuing a postsecondary education and to postsecondary educational institutions. The 
provisions of the HEA apply differently to information collected or derived from the FAFSA/ISIR 
(including institutional award and disbursement information) and to data included in NSLDS (including 
data on the ISIR from NSLDS). 


Section 483(a)(3)(E) of the HEA restricts the use of the FAFSA/ISIR data to the application, award, and 
administration of aid awarded under federal student aid programs, state aid, or aid awarded by eligible 
institutions. The Department interprets “administration of aid” to include audits and program 
evaluations necessary for the efficient and effective administration of those student aid programs. 


Section 485B(d)(2) of the HEA prohibits nongovernmental researchers or policy analysts from accessing 
PIl from NSLDS, while HEA section 485B(d)(5)(B) prohibits the use of NSLDS data for marketing 
purposes. It is important to note that these prohibitions are applicable to all NSLDS data, including 
NSLDS data received by institutions via the ISIR. 


Privacy Act 


The Privacy Act governs the collection, maintenance, use, and disclosure by federal agencies of records 
contained in the agencies’ systems of records.!! The Privacy Act requires federal agencies that maintain a 
system of records to comply with a number of requirements, including, but not limited to, establishing 
appropriate safeguards to ensure the security and confidentiality of these records.'!2 As discussed in 
more detail below, the Department enters into a Student Aid Internet Gateway (SAIG) Agreement with 


'0 34 CFR § 99.31 (a)(6)(iii) 

'! The term “system of records” means a group of any records under the control of any agency from 
which information is retrieved by the name of the individual or by some identifying number, symbol, or 
other identifying particular assigned to the individual. 5 U.S.C. 552a(a)(5). 

"5 U.S.C. 552a(e)(10) 
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institutions to establish the conditions and safeguards under which the Department provides institutions 
with the Department's Privacy Act-protected student financial aid data. 


The Privacy Act generally prohibits federal agencies from disclosing records from their systems of 
records without prior written consent of the individual to whom the record pertains. There are a 
number of exceptions to this provision that can be found in 5 U.S.C. 552a(b). Of the exceptions listed, 
Section 552a(b)(3) and 552a(b)(5) are particularly relevant to the Department in terms of permitting the 
Department to disclose Privacy Act-protected student financial aid data to institutions. Section 
552a(b)(3) permits the Department to disclose a record from a system of records without written 
consent for “a routine use,” which means, with respect to the disclosure of a record, the use of such 
records is restricted to purposes compatible with the purpose for which the record was collected. The 
specific routine uses allowed for each system of records are listed in the applicable System of Records 
Notice.!3 Section 552a(b)(5) permits the Department to disclose a record from a system of records 
without written consent to a receiving entity that has provided written assurance that the record will be 
used solely as a statistical research or reporting record and that the record is to be transferred in a 
form that is not individually identifiable.'4 In cases where the institution seeks to disclose student 
financial aid data that was obtained directly from a system of records of the Department to another 
entity for statistical research purposes, the disclosing entity (e.g., the institution) must provide the 
Department with a written assurance that the data obtained from the Department’s system of records 
have been properly de-identified, and the receiving entity (e.g., the researcher) must provide the 
Department with a written assurance that the data will only be used for statistical purposes. These 
written assurances must be sent to PTAC (at PrivacyI A@ed.gov) before an institution discloses an 
individual student’s financial aid data obtained directly from a system of records of the Department to 
another entity for statistical research purposes without the student’s written consent. 


Student Aid Internet Gateway 


The SAIG was established to allow authorized entities, including postsecondary educational institutions, 
to exchange data electronically with the Department. The SAIG Agreement establishes the conditions 
under which the Department will provide to the institution certain data received or generated by the 
Department concerning FAFSA applicants as well as other Department data. The Department has a 
contractual agreement with every institution that receives financial aid information through the SAIG. All 
data uses must be consistent with this Agreement. Under the SAIG Agreement, access, disclosure, and 
use of data is limited to “authorized personnel.” The Department interprets “authorized personnel” to 
include anyone who is permitted access to the information under all applicable statutes and regulations. 


'3 The Privacy Act requires Federal Agencies to publish notices in the Federal Register for all systems of records 
that they maintain. The U.S. Department of Education’s Systems of Records Notices (SORNs) are available on the 
Department's website at: https://www2.ed.gov/notices/ed-pia.html 

'4 OMB Guidelines, 40 Fed. Reg. 28,948, 28,954 -July 9, 1975 
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Frequently Asked Questions 


Can an institution provide student financial aid data obtained directly from NSLDS and that 
are de-identified to a researcher not affiliated with the institution? 


Yes, under certain circumstances, an institution may provide de-identified student financial aid data 
originally obtained directly from NSLDS to a researcher not affiliated with the institution for statistical 
research purposes. The Privacy Act permits the nonconsensual disclosure of records to an individual 
who has provided the Department with written assurance that the records will be used solely for 
statistical research purposes and that the records will be transferred in a form that is not individually 
identifiable.'> Both the institution’s written assurance that the data have been properly de-identified and 
the researcher’s written assurance that the data will only be used for statistical purposes must be sent 
to the PTAC (at PrivacyT A@ed.gov) before disclosing a student’s financial aid data obtained directly 
from a system of records of the Department without the student’s consent. FERPA also permits 
institutions to disclose de-identified records and information pursuant to 34 CFR § 99.31 (b). If, however, 
the data are not obtained directly by the institution from a Department system of records (such as 
NSLDS) and are ISIR data maintained by the institution, written assurance to PTAC is not required. In 
this case, the applicable HEA and FERPA provisions governing NSLDS and FAFSA/ISIR data still apply. 
For guidance on the proper de-identification of data, please consult PTAC’s resources on disclosure 
avoidance and de-identification, available at https://studentprivacy.ed.gov. 


Can an institution that is legally part of a public system of postsecondary institutions 
provide ISIR data including PII, to their administrative central system-wide office or 
governing board staff for an evaluation of tuition and student financial aid programs? 


Yes, if the central office or governing board is considered a state educational authority under state law, 
the institution may provide ISIR data, including Pll, to such central office or governing board for the 
purpose of evaluating tuition and student financial aid levels. The evaluation of federal- or state- 
supported financial aid programs administered by the institution is permissible under FERPA's "audit or 
evaluation" exception. And, as the measurement and analysis of the impact of federal, state, and 
institution-system student aid programs and policies is necessary for data-driven decision-making, the 
evaluation can be considered part of the broader process of "administration of aid [under Title IV,] state 
aid, or aid awarded by eligible institutions," and thus is permissible under the HEA. In this scenario, while 
the data include PIl, the HEA prohibitions on accessing NSLDS data do not apply since the recipients are 
governmental researchers or policy analysts, and the NSLDS data are not being used for marketing 
purposes. Since the institution is not obtaining student financial aid data directly from a Department 
system of records, the Privacy Act does not apply to the institution in this scenario. 


Can an institution generate and publish de-identified, aggregate statistics using FAFSA/ISIR 
data about students receiving financial aid at the institution? 


Yes, the Department considers the production of de-identified, aggregate, descriptive statistics about 
program participants to be a permitted use of FAFSA/ISIR data related to the administration of a 
financial aid program. In contrast with the disclosure of de-identified data obtained directly from the 
Department’s systems of records, as discussed above, no assurance is required for the release of 
properly de-identified, aggregate data in these circumstances. Under the HEA, if the aggregate statistics 
being generated and published use NSLDS data, then those statistics cannot be used for marketing 


*5 U.S.C. § 552a(b)(5) 
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purposes. Since the institution is not obtaining student financial aid data directly from a Department 
system of records, the Privacy Act does not apply to the institution in this scenario. For guidance on 
how to properly de-identify aggregate statistics, please consult PTAC’s resources on disclosure 
avoidance and de-identification, available at https://studentprivacy.ed.gov. 


Can an institution use a student’s financial aid information provided by a student on the 
FAFSA to recruit a student who has not yet enrolled or tried to enroll at the institution? 


Yes, if the prospective student elected to have his or her FAFSA information sent to the institution, the 
institution’s admissions office may contact the student about the application and admission process. The 
financial aid office may use the student’s financial aid information provided by the student on the FAFSA 
to communicate proposed financial aid award information. FERPA is not implicated, as the student has 
not yet enrolled at the institution. The HEA permits this disclosure and use as it directly relates to the 
process of awarding financial aid to the prospective student. Since the institution is not obtaining student 
financial aid data directly from a Department system of records, the Privacy Act does not apply to the 
institution in this scenario. However, even when permissible under applicable federal laws, institutions 
should consider whether nonconsensual use of Pll in this fashion is consistent with institutional values, as 
well as state and local law. 


Can an institution’s housing office obtain FAFSA/ISIR data to determine if a student qualifies 
for a housing fee deferral pending financial aid disbursement? 


Yes, this is permissible under the HEA to the extent that the information is related to the effective and 
efficient administration (in this case, disbursement) of financial aid. It is also permissible under FERPA’s 
School Official exception, provided that the criteria in the institution’s annual notification of FERPA 
rights have been met. That is, the institution must determine that the disclosure is to a school official 
with a legitimate educational interest. Since the institution is not obtaining student financial aid data 
directly from a Department system of records, the Privacy Act does not apply to the institution in this 
scenario. 


Can a financial aid office share FAFSA/ISIR data, including PII about students who receive 
student aid, with institutional staff responsible for analyses, audits, or evaluations at the 
institution (e.g., an Institutional Research Office)? 


Under some circumstances, this may be permissible. Under FERPA’s School Official exception, this is 
permissible provided that the recipient meets the criteria of a “school official with legitimate educational 
interest” as defined in the institution’s annual notification of FERPA rights. Under the HEA, this may be 
permissible to the extent that the Institutional Research Office, auditor, or analyst is performing a 
function that is necessary to the efficient and effective administration of student aid. And, if the data are 
NSLDS data, this may be permissible under HEA depending on whether the recipients of the data are 
governmental researchers or policy analysts. Disclosure for other purposes, however, is not permitted. 
Since the institution is not obtaining student financial aid data directly from a Department system of 
records, the Privacy Act does not apply to the institution in this scenario. 


Can a financial aid office share FAFSA/ISIR data with an outside non-state scholarship 
organization? 


No, the HEA only permits disclosure of student aid data for the purposes of application, award, or 
administration of aid awarded under federal student aid programs, state aid programs, or aid awarded by 
eligible institutions. Since the scholarship organization is not operating one of these programs, the 
institution may not disclose students’ FAFSA/ISIR data, including award eligibility information, to the 
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organization. Since the institution is not obtaining student financial aid data directly from a Department 
system of records, the Privacy Act does not apply to the institution in this scenario. 
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Resources 


Family Educational Rights and Privacy Act Regulations: http://www.ecfr.gov/cgi-bin/text- 
idx?c=ecfr&SID=16796a773ac48f980cdfaed80b | fa94a&rgn=div5&view=text&node=34:1.1.1.1.33&idno=3 
4%20. 


Federal regulations resources web page at the U.S. Department of Education: 
www.ed.gov/policy/gen/reg/edpicks.jhtml?src=In. 


U.S. Department of Education, Family Policy Compliance Office: https://studentprviacy.ed.gov. 


U.S. Department of Education, Family Policy Compliance Office (2015): Model Notification of Rights under 
FERPA for Postsecondary Institutions, available at http://www2.ed.gov/policy/gen/guid/fpco/ferpa/ps- 
officials.html. 


U.S. Department of Education, Privacy Technical Assistance Center: https://studentprivacy.ed.gov. 


U.S. Department of Education, Privacy Technical Assistance Center (2012, updated 2015): Case Study #1: 
High School Feedback Report, available at 
https://studentprivacy.ed.gov/resources/files/case-study- | -high-school-feedback-report. 


U.S. Department of Education, Privacy Technical Assistance Center (2012, updated 2015): Case Study 
#4: PTAC Technical Assistance, available at https://studentprivacy.ed.gov/resources/case-study-4-ptac- 
technical-assistance. 


U.S. Department of Education, Privacy Technical Assistance Center (2012, updated 2015): Written 
Agreement Checklist, available at https://studentprivacy.ed.gov/resources/written-agreement-checklist. 


U.S. Department of Education, Privacy Technical Assistance Center (2012, updated 2013): Data De- 
identification: An Overview of Basic Terms, available at 
https://studentprivacy.ed.gov/resources/data-de-identification-overview-basic-terms. 


U.S. Department of Education, Privacy Technical Assistance Center (2014): FERPA Exceptions Summary, 
available at https://studentprivacy.ed.gov/resources/ferpa-exceptions-summary-large-format-| | -x-|7. 


U.S. Department of Education, Privacy Technical Assistance Center (2012, updated 2015): Frequently 
Asked Questions — Disclosure Avoidance, available at 
https://studentprivacy.ed.gov/resources/frequently-asked-questions-disclosure-avoidance. 


U.S. Department of Education, Privacy Technical Assistance Center (2015): Guidance for Reasonable 
Methods and Written Agreements, available at 
https://studentprivacy.ed.gov/resources/guidance-reasonable-methods-and-written-agreements. 


U.S. Department of Education, Privacy Technical Assistance Center (2012): Webinar: FERPA for Colleges 
and Universities, available at https://studentprivacy.ed.gov/training/ferpa-colleges-and-universities- 


february-2012. 
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